Why am I unable to filter log data from extracted fields?

[Manideep]

scenario : - I had a log file. I am able to extract the fields from the log event and also see the data in the extracted fields. But when I am filtering the data with use of extracted field, unable to see the results although it has data in the extracted field. 

I have referred to this "http://blogs.splunk.com/2011/10/07/cannot-search-based-on-an-extracted-field/" link it doesn't help. 

Please help us regarding this.

[Manideep]

My query  |  rex field=_raw "(?msi)(?<SiteId>(?<=SiteId:).+?(?<=\n))" | spath input=SiteId

with the above query i am able to see the values under "SiteId" fields

[gcusello]

Hi @Manideep,

I assume that the regex correctly extracts values.

the field name is exactly "SiteId" or there's something before?

are you shure about the case of the letters in the field name? values aren't case sensitive but field names are case sensitive.

Then, having you a regex, why do you use spath?

Ciao.

Giuseppe

[gcusello]

Hi @Manideep,

could you share your not working search?

ciao.

Giuseppe